Free, Libre, and Open Source Software Leftovers

posted by Roy Schestowitz on Jan 11, 2026

• Mitchell Hashimoto ☛ Finding and Fixing Ghostty's Largest Memory Leak

  A few months ago, users started reporting that Ghostty was consuming absurd amounts of memory, with one user reporting 37 GB after 10 days of uptime. Today, I'm happy to say the fix has been found and merged. This post is an overview of what caused the leak, a look at some of Ghostty's internals, and some brief descriptions of how we tracked it down.1

• Web Browsers/Web Servers

  • [Old] Web Performance Calendar ☛ Fixing the URL params performance penalty - Web Performance Calendar

    Here, I think it’s safe to assume the page is going to contain details of different products.

    So it’s not always obvious when query params result in different content, and when they don’t.

    In fact it’s even more complicated than that, because the initial HTML for the above two pages might in fact be the exact same! For client-side rendered (CSR) applications, very little unique content is often included in the initial HTML and JavaScript is then used to fetch and display the different content.

    So why’s this a problem?

• Security and Entrapment (Microsoft GitHub)

  • Russell Coker ☛ Russell Coker: Terminal Emulator Security

    I just read this informative article on ANSI terminal security [1]. The author has written a tool named vt-houdini for testing for these issues [2]. They used to host an instance on their server but appear to have stopped it. When you run that tool you can ssh to the system in question and without needing a password you are connected and the server probes your terminal emulator for vulnerabilities. The versions of Kitty and Konsole in Debian/Trixie have just passed those tests on my system.

    This will always be a potential security problem due to the purpose of a terminal emulator. A terminal emulator will often display untrusted data and often data which is known to come from hostile sources (EG logs of attempted attacks). So what could be done in this regard?

• SaaS/Back End/Databases

  • Ruben Schade ☛ Messing with uuid() in SQLite3

    Unbeknownst to me, SQLite3 now has a UUID extension that can generate valid UUIDs on the fly. And fortunately, my install had this compiled in, which can be invoked thusly: [...]